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MNEMONIC DESCRIPTION PG. NO. 

A/B A - left mid & right outboard backup driven 32 
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AFTI Advanced Fighter Technology Integration 8 
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(sweep 26 deg) 
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AYC adverse yaw compensation 2 

BU backup 37 
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C & D control and display 1 

CCC cruise camber control, auto mode Fig. 8 

CDGT26 wing sweep command greater than 26 deg 9 
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AP differential pressure across the PDU 3 

DETIHB fail inhibit flag 14 
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12 
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Fig. 6 
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3 
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INBD BRAKE 

manual inboard flap brake switch 

20 

INBD FAIR 

command discrete for inboard flap fairing 

9 

INBD STATUS 

inboard flap failure monitor light 

20 

INBKSW 

inboard brake input discrete 

16,17 

INBRK 

inboard flap brake command discrete 

7 

INLIVE 

inboard aliveness fault 

31 

INMODL 

inboard model faults 

32 

INPOSL 

inboard position fault 

33 

INTMID 

integrator output, midspan 

5 

INTOUT 

integrator output, outboard 

5 

INVMON 

inboard valve monitor fault 

30 

KRSTICK 

roll stick gearing gain 

4 

LE, TE 

leading edge, trailing edge 

3 

LEBRAK 

leading edge brake discrete 

13 

LIM 

limiter 

Fig. 6 
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left inboard position 

Fig. 14 

LVDT 

linear variable differential transducer 

& Fig. 2 8 

LWD 

left wing down 

Fig. 6 

MAN 

manual 

Fig. 8 
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Mission Adaptive Wing 
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MAW CAUTION 

MAW warning annunciator 

12 

MCC 

maneuver camber control, auto mode 

Fig. 8 

MCP 

manual command program 

4 

MID 

midspan 

3 

MIDMRF 

mid model fault, raw 

32 

MLC 

maneuver load control, auto mode 

Fig. 8 
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MAW preflight test fail annunciator 

14 

OMLIVE 

out/mid aliveness fault 

31 
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32 
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33 
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out/mid valve monitor fault 

30 

ONGEAR 
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12 

OUT 
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3 
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32 

P 

primary hydraulics 

3 
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power drive unit 

3 

PHYDOF 

primary hydraulics fault 

34 

pri hydr press 

primary hydraulic pressure 

34 
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programmer 

7 

PRIPWR 

primary system power supply fault 

33 
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13 
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12 
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14 
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2 

TED 

trailing edge down 

25 

U 
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34 
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1.0 INTRODUCTION 


A joint Advanced Fighter Technology Integration (AFTI) program was 
created with the National Aeronautics and Space Administration (NASA) 
and the United States Air Force to demonstrate a mission adaptive wing 
(MAW) concept. Flexible leading and trailing edge flaps and a flight 
control system for the MAW surfaces were incorporated in the NASA F-1 1 1 
research aircraft. 

The manual wing-camber control system provides position and rate 
commands for two leading edge and six trailing edge wing surfaces. Each 
of these surfaces is controlled by dual hydraulic servos. These servos 
receive commands from a dual digital control system when under primary 
control, or from a dual analog control system when under backup control. 

The pilot’s interface to the MAW surfaces is provided from the stick, 
flap selector switch, and MAW control panel. The stick provides roll 
control to the midspan and outboard MAW flaps, and to the differential 
stabilon surfaces. The flap selector switch commands three symmetric 
flap positions. Finally, the MAW control and display (C&D) panel allows for 
symmetric flap slewing throughout the flap deflection range. 

The system design is limited fail-operational, whereby for most 
primary system failures the FCS downmodes to the backup system, which 
lacks some of the functions of the primary system. Failures within the 
backup system will cause a MAW flap pair(s) to be braked. This is because 
of the partitioning of the surfaces in the backup system. 

This document describes the MAW manual flight control system 
including the modifications that were made to the basic TACT flight 
control system. In addition, the redundancy management of the MAW 
primary and backup FCS is described. 

2.0 MODIFIED TACT/F-111 FLIGHT CONTROL SYSTEM 

The primary function of the MAW FCS is to drive only the wing 
surfaces, while the F-1 1 1 system drives the rudder and stabilon, though 
there is some interfacing between the two systems (ref. 1 ). Briefly, the 
functions are as follows: 
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2.1 Pitch Channel 


The TACT flight control system switch should generally remain in the 
NORMAL position. The function of this switch is replaced by the added 
MAW flap switch, which causes the following TACT functions to occur: 


TACT Functions 


MAW Flap Switch 


pitch channel gain 
pitch acceleration feedback 
auxiliary pitch trim 
series pitch trim actuator 


HALF or FULL 
fixed at 30 % 
off 

enabled 

locked 


RETRACT 

adaptive 

on 

disabled 

unlocked 


If the TACT flight control system switch is put in TAKEOFF or LAND, 
the effect on the F-1 1 1 FCS would be the same as placing the flap switch 
in the HALF or FULL position even if it were to remain in RETRACT. 


2.2 Roll Channel 


When the flap switch is put in either the HALF or FULL position, or the 
TACT flight control system switch is placed in T.O. or LAND, the roll 
adaptive gain will be fixed at 100 percent. This is the same logic that 
applied for the pitch channel concerning the TACT flight control system 
switch. 


2.3 Yaw Channel 

The flap switch which was used to reconfigure the TACT FCS for the 
pitch and roll modes is also used in the yaw axis. The following logic 

occurs: 


TACT Functions 


rudder authority 
adverse yaw compensation 


MAW Flap Switch 

HALF or FULL RETRACT 
±30° ±11.25° 

on off 
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A roll rate feedback switch has been added to the left side panel to 
disable the roll rate component portion of the adverse yaw compensation 
(AYC) logic. Normally, this switch is off. 

3.0 MAW SYSTEM ARCHITECTURE 

The MAW flaps are controlled by dual flight control electronics units 
(FCEU). Each FCEU is wired identically, therefore channel 1 is 
distinguished from channel 2 by grounding a discrete (IDENT) in the 
connector attached to the FCEU which is in position "one." 

The basic MAW flap actuation system consists of a hydraulic motor, 
gear reduction box, electric brake, rotary actuator, control module, and 
torque tube. The motor, gear box, servo control valve, and brake are housed 
in a single module called a power drive unit (PDU), as shown in figure 1 . 
The thin airfoil section of the TACT wing necessitated the use of this 
compact arrangement. There are 2 PDU's per surface, which make a total 
of 1 6 (1 2 trailing edge and 4 leading edge). The servo control valve and 
electrical position feedback complete the loop in the servo system. Either 
PDU can drive any flap with reduced hinge moment capability. 

The MAW system architecture for the primary FCS is shown in figure 2. 
The numbers at each end of the flaps represent a PDU number while the P 
and U indicate a primary or utility hydraulic system. Each PDU is 
dedicated to a particular hydraulic system (primary or utility). Note that 
each flap is driven by both processors. Both primary computers receive a 
dedicated differential pressure (AP) and flap position LVDT. 

The backup FCS architecture is shown in figure 3. The backup FCS has 
no control of the leading edge flaps. Also, the trailing edge flaps are 
partitioned differently. Backup system A drives both PDU's of the left 
midspan, right outboard, and the inner PDU's of the inboard flaps. Backup 
system B drives both PDU's of the left outboard, right midspan, and the 
outer PDU's of the inboard flaps. The backup system has its own dedicated 
LVDT's. Note that the roll flaps have only one backup LVDT per surface. 

The roll stick partitioning is shown in figure 4. There are six MAW roll 
stick transducers (two for primary and four for backup). Each backup 
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system receives two stick inputs. 

The flap switch redundancy is shown in figure 5. There are four 
contacts for the FULL and HALF positions. Two of these discretes go to the 
primary system, while a different set goes to each backup system. 

4.0 MAW FLIGHT CONTROL SYSTEM 

The MAW FCS is a redundant fly-by-wire control system. It has a dual 
digital primary system architecture that provides roll and symmetric 
commands to the MAW control surfaces. A segregated analog backup 
system is provided in the event of a primary system failure. The MAW FCS 
was designed to be isolated from the basic F-1 1 1 FCS as much as possible 
so that any problem which developed from the MAW system would not 
affect the basic systems. 

4.1 Manual Flight Control System - Primary 

The primary system is designed to manually slew the leading edge and 
trailing edge flaps symmetrically and to provide roll control that was lost 
by the removal of the spoilers from the TACT wing. Control of the MAW 
flap surfaces is accomplished by the use of a flap switch, roll stick, the 
C&D panel, wing sweep handle, and gun trigger switch. Reference 2 gives 
details of the primary system specification. Simplified block diagrams of 
the MAW flight control system follow. 

A block diagram of the MAW control system showing the roll and 
symmetric commands is shown in figure 6. The nose and side QC probes 
are filtered to reduce the noise and then averaged for use in scheduling the 
roll stick gearing gain (KRSTICK). A lead-lag filter used in the stick input 
path quickens the roll response for the takeoff and landing configuration. 
The roll gain of 1.95 provides 18.5° of roll authority based on 9.5 V of 
stick command which is at the 2.5 in soft stop detent. If a QC fail occurs, 
the KRSTICK is fixed depending on the flap switch position. This is 
discussed in section 4.1 .14.3. 

The roll command (ROLCOM) is formed by summing the roll stick with 
the MAW roll trim. The MAW trim has a ±2° limit. Trim commands are 
faded out either by pressing the trim reset switch or for backup mode 
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reversion. 


Symmetric commands are formed by integrating the various ways of 
commanding symmetric flap motion. The priority is shown left to right at 
the bottom of the figure. The manual command program (MCP) has the 
lowest priority, with the inboard flap fairing having the highest. 

A block diagram of the servo commands is shown in figure 7. The roll 
flap servo commands are formed by summing ROLCOM with integrator 
inputs (INTMID and INTOUT). The trailing edge flap deflection limits are 
scheduled with QC. Each flap is rate limited. The primary commands track 
the positions whenever the system is in backup. For a transfer to the 
primary system the commands are faded from the present flap position to 
the new, updated primary commands in 2 sec. 

The MAW C&D panel is shown in figure 8. The panel is used in 
conjunction with the roll stick to control the various functions of the MAW 
flaps. The status and MAW flap positions are also displayed. A 
description of the manual MAW control functions follows. 

4.1.1 PRIMARY/BACKUP switch. 

The primary/backup switch is located on the upper left side of the MAW 
panel. This is a four-pole switch which provides a positive switch to the 
backup system OR gate. When the switch is in the primary position, the 
switching logic is armed to return to the primary system. 

4.1.2 FLAP switch. 

The flap switch located on the front panel of the cockpit is used to 
command the flaps to three camber configurations: HALF - 15° LE, 10’ TE; 
FULL - 20’ LE, 18’ TE; and RETRACT - 5* LE, 2’ TE. Two discretes are 
issued when the switch is placed in the FULL position and a second 
discrete set is generated in the HALF position. A single discrete signal 
goes to each primary channel. The absence of any signal from the flap 
switch indicates that the flap switch is in the RETRACT position. 

To compensate for lags between the discretes to the primary FCEU's, a 
1 sec delay is used before recognizing a change in the flap switch position. 
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This allows both FCEU's to respond at the same time before issuing a flap 
command which could otherwise result in a command difference and 
downmode to backup. The discretes are passed regardless of their values 
after 1 sec. 

4.1 .2.1 RETRACT: 

1 . The flaps move to LE/TE of 5/2° at a rate of 2 deg/sec. 

2. The position accuracy is ± 0.5*. 

3. No flap annunciator lights illuminate for the RETRACT position. 

4.1 .2.2 HALF: 

1 . The flaps move to LE/TE of 1 5/1 0° at a rate of 2 deg/sec. 

2. The position accuracy is ± 0.5*. 

3. The HALF flap annunciator illuminates when the inboard and LE 
position LVDT's indicate that the surfaces are within 1 0 of the 
symmetric command. 

4. The roll stick command goes through a lead-lag filter, (S + 3)/(S + 8). 

4.1 .2.3 FULL: 

1 . The flaps move to LE/TE of 20/1 8* at a rate of 2 deg/sec. 

2. The position accuracy is ± 0.5*. 

3. The FULL flap annunciator illuminates when the inboard and LE 
position LVDT's indicate that the surfaces are within 1 * of the 
symmetric command. 

4. The roll stick command goes through a lead-lag filter, (S + 3)/(S + 8). 

4.1 .3 Slew switches. 

There are five sets of three-position, spring-loaded symmetric 
command slew switches. The following pairs of surfaces can be slewed: 

LE, INBD, MID, OUT, and ALL. The flaps can be slewed to the full deflection 
limit allowed by the QC limiter. 

4.1 .4 Rate select. 

The slew rate switch allows symmetric slewing at three different 
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rates: FAST = 5 deg/sec, NORM = 1 deg/sec, SLOW = 0.33 deg/sec. This 
slew rate switch affects only the slew switches and the manual command 
program (MCP). 

4.1.5 Roll trim. 

The roll trim switch is used to command asymmetric trim for the MAW 
roll surfaces (midspan and outboard) at a slew rate of 0.3 deg/sec. It has 
a limited authority of ± 2' about the symmetric command. 


4.1.6 Trim reset. 

The TRIM RESET light illuminates when the absolute value of the roll 
trim command is greater than or equal to 0.01 \ Pressing the TRIM RESET 
button will cause the roll trim command to fade out in 4 sec. The light 
goes out when the roll trim command is reduced below 0.01°. 


4.1.7 Manual command program. 


The manual command program (MCP) function is used in combination 
with a 1 2-position selector to automatically slew the leading edge and 
trailing edge flaps to 1 1 predefined settings at a rate indicated by the 
RATE SELECT switch. Position zero is an off position. The flap switch 
must be in the RETRACT position for the MCP to function. When the MCP 
button is pressed, the TRANST light will illuminate to indicate that the 
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naps ary in the process of being commanded to an MCP flap position. 
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all the flaps are within the command accuracy (dictated by the slew rate), 
the TRANST light goes out and the VALID light illuminates. Command 
accuracy = slew rate/1 00. 


PRGMR STEP 

LE 

INBOARD 

MIDSPAN 

OUTBOA 

0 

NA 

NA 

NA 

NA 

1 

2 

2 

2 

2 

2 

0 

6 

6 

6 

3 

0 

10 

10 

10 

4 

5 

6 

6 

6 

5 

5 

10 

10 

10 


7 


6 

5 

17.8 

18 

18 

7 

10 

2 

2 

2 

8 

10 

10 

10 

10 

9 

10 

17.8 

18 

18 

10 

15 

6 

6 

6 

11 

15 

10 

10 

10 


4.1 .8 Wing sweep inboard flap fairing. 

The sweep range for the AFTI/F-1 1 1 is from 10 to 58’. At 
approximately 35* of sweep the inboard flaps begin to enter the wing seal 
on the fuselage. Before this entry, the inboard flaps must be guaranteed to 
be in the correct "faired” position. The primary wing sweep logic (ref. 3) 
description follows. 

The basic F-1 1 1 has a 26* detent on the sweep lever that prevents 
further aft sweeps unless certain logic is satisfied, as shown in figure 9. 

1 . Put the wing sweep lever at the 26* detent. 

The wing sweep position must be greater than 24.5* to initiate the fairing 
logic. 

2. The flap switch must be in RETRACT. 

Flap fairing logic cannot be activated if the flap switch is in the HALF 
or FULL position. Once the sweep is aft of 26*, the flap switch can be put 
in HALF or FULL and the inboard brake logic will still remain set. 

3. Press the INBD FAIR button on the C&D panel and release in less than 2 
sec. 

This generates a "fair” command to slew the inboard flaps to 1 .8° 
trailing edge down at a rate of 10 deg/sec. The INBD FAIR switch 
illuminates while the inboard flaps are being driven to the "faired" 
position and then goes out. Both inboard flaps are tested for 3 sec to be 
within a 0.2* tolerance of the 1 .8* faired command position. If the flaps 
are not within 0.2* during the first 3 sec, the tolerance is opened to 0.6*. 
After all four primary inboard LVDT's show that these flaps are within the 
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tolerance, the following output discretes are generated: ANFAIR, ANIBRK, 
INBRK, and SWP ENABLE. The discrete (INBRK) is issued to the backup 
hardware. When both computers send out this discrete, the inboard flaps 
are braked. The SWP ENABLE discrete releases the sweep lever solenoid to 
allow sweeps beyond the detent. The FAIRED light indicates that the 
fairing logic has been requested and that all four primary inboard LVDT's 
indicate that the flaps are within the specified tolerance. 

4. Pull the sweep lever aft and through the detent. 

When the sweep position reaches about 26.5’ to 27*, a command and 
sweep position greater than 26’ discretes are set (CDGT26 and SWGT26, 
respectively). These discretes serve to latch the sweep logic in case the 
INBD FAIR should be pressed. The FAIROK flag stops a failure path in 
fairing the flaps in case the CDGT26 and SWGT26 discretes were to be set. 

5. The inboard brakes can be released by two methods: (1 ) sweep the wing 
forward of 24.5’, or (2) sweep the wing back to the 26’ detent and press 
the INBD FAIR button. 

CAUTION - There is one known problem with the sweep logic. The 
lever lockout can be defeated by sweeping the wing forward and stopping 
just aft of the detent so that CDGT26 and SWGT26 discretes become false 
without the lever lockout becoming engaged. At this point the lever can be 
pulled aft again and there will be no fairing command for the inboard flaps. 
To reestablish the fairing command, the INBD FAIR button must be pressed. 
This aaain sets the rnnijimd FAIROK loaic. 

The proper procedure for sweeping the wing forward is to bring the 
lever back into the detent or forward of the detent. 

4.1 .9 Flap rate limits. 

Rate limiters are used to help prevent overspeeding the power drive 
units (PDU's). The maximum rate of change in the servo commands for each 
flap pair is shown below. A 3 deg/sec overspeed for the roll flaps is 
allowed for aiding wind loads. 


9 



CONTROL SURFACE 

RATE, dea/sec 

LEADING EDGE 

10 

INBOARD 

30 

MIDSPAN 

40 

OUTBOARD 

40 


4.1.10 Surface position accuracy. 

The total error from the command source to the actual surface position 
(as measured by a protractor), which includes all error sources from the 
analog and digital components, is less than 0.5*. 

4.1.11 HOME command. 

The gun trigger switch from either stick can be pressed to command 
the LE and TE flaps to a HOME position of 0’ and 2', respectively. The flap 
rate is 5 deg/sec. The flaps selector switch must be in RETRACT for this 
function. 

4.1.12 Ground roll brake. 

The MAW flaps can be used for ground roll braking for landings. The 
following conditions must be established for the ground roll braking to 
occur: 

1 . Ground roll brake enable switch in the cockpit is set. 

2. The flaps are in the FULL position. 

3. Weight is detected on the main gear. 

4. Both thrust levers are in their idle positions. 

A 0.1 sec time delay is provided after the above conditions are 
satisfied. The table below shows the flap requirements. 

POSITION RATE 

LEADING EDGE 20.0* 10 d/s 

TRAILING EDGE -0.5* 40 d/s 

A GND ROLL light will illuminate on the MAW panel to indicate that the 
LE and TE flaps are within 1 ° of the symmetric commands. When the 
ground roll brake is released the LE and TE flaps will return to the flap 
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selector commanded value at a rate of 1 0 and 20 deg/sec, respectively, for 
the first second. After the first second the flap rates return to the normal 
2 deg/sec rate. 

4.1.13 Flap position limits. 

There is danger of damage to the flap mechanism if the mechanical 
stops are contacted three or more times during flap cycles. Therefore, the 
system has software limits which further reduce the flap limits from the 
mechanical stops. 




LEADING EDGE 

INBOARD 

MIDSPAN 

OUTBOARD 

Mechanical 

up 

-2.10 

-2.60 

-2.35 

-2.53 

stop, deg 

dn 

21.30 

19.00 

21.00 

20.83 

Software 

up 

-1.07 

-1.08 

-0.69 

-0.71 

limit, deg 

dn 

20.63 

17.87 

19.74 

19.59 


4.1.14 QC scheduling. 

There are two impact pressure (QC) probes on the airplane that are 
filtered in hardware 2/(S + 2), and then again in software 20/(S + 20) to 
suppress the noise. This averaged signal (QCAVE) is used to limit the 
downward deflection for the MAW TE flaps and to schedule the roll stick 
gain (fig. 10). 

4.1.14.1 QCTE limiter: 

For a QCAVE less than 830 lb/ft 2 , there is no QC TE limiting. If QCAVE 
is between 830 and 1360 lb/ft 2 the TE is QC limited linearly from 21 0 to 
4°. For a QCAVE greater than 1360 lb/ft 2 the TE limit is fixed at 4*. 

4.1.14.2 Roll stick gain: 

If the QCAVE signal is less than 150 lb/ft 2 , the gain stays at 100 
percent. If the QCAVE is between 150 and 250 lb/ft 2 , the gain decreases 
linearly from 1 00 percent to 27 percent. For a QCAVE greater than 250 
lb/ft 2 the gain remains at 27 percent. 
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4.1.14.3 QC fail scheduling: 

A failure will be declared if the two impact pressure probes differ by 
more than 1 00 lb/ft 2 . The TE limiter and roll stick gain are set at fixed 
values depending on the flap switch position (fig. 11). If the flaps are in 
HALF or FULL, the TE limiter will be at full authority and the roll stick 
gain at 1 00 percent. If the flaps are in RETRACT, the TE limiter and roll 
stick gain will both be set at the minimum values of 4* and 27 percent, 
respectively. 

4.1.15 Pref light test program. 

A pilot-activated ground preflight test is provided to test the 
following functions of the MAW FCS: 

1 . The delta pressure monitors for the eight flap surfaces 

2. The leading edge brake hardware latch 

3. The backup system hardware latch 

Entry into the preflight test program is possible only on the ground. The 
following conditions must be satisfied in order to activate the preflight 
test program: 

1 . No failures are detected and the system is in primary. 

2. The leading edges are not braked. 

3. The preflight test switch is in the "on" position. (This action causes 
the MAW CAUTION annunciator to flash.) 

4. The preflight selector switch is in position "one." 

5. The weight on wheels switch is set (ONGEAR). 

6. Both throttles are in "idle." 

7. Wing sweep is less than 26*. 

8. Flap switch is in RETRACT. 

9. All surfaces are within 1 * of their HOME position (press the gun 
trigger). 

1 0. Press the GO/NO-GO button to start the preflight test. 

A counter (PTISTP) within the preflight test program is incremented from 
0 to 120 in steps of 10 as each test is completed (fig. 12). 
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PTISTP 


PREFUGHT TEST ACTION 


1 0 Slew the flap commands down to 1 8* from FCEU 1 while 

keeping the commands from FCEU 2 at 2\ Test for all eight 
delta pressure fail monitors from both FCEU's. When these 
are set, go to the next step. 

20 Fade out the flap command offset from FCEU 1 . Test that all 
eight delta pressure fail monitors from both FCEU's have reset. 

30 Slew the flap commands down to 1 8’ from FCEU 2 while 

keeping the commands from FCEU 1 at 2°. Test for all eight 
delta pressure fail monitors from both FCEU's . When these are 
set, go to the next step. 

40 Fade out the flap command offset from FCEU 2. Test that all 
eight delta pressure fail monitors from both FCEU's have reset. 

50 Set a software signal (PTBRAK) to brake the leading edge flap. 
After six minor cycles, examine the hardware latch circuit of 
LEBRAK. If LEBRAK is "true" proceed to the next step. 

60 Reset PTBRAK; after nine minor cycles, examine LEBRAK to 
determine if it is still latched. If LEBRAK is "true" proceed to 
the next step. 

70 Set a software signal (PTFAIL) from FCEU i that commands the 
system to backup. After nine minor cycles, examine the 
hardware latch circuit of the backup lamp driver (BUTEST). If 
it is "true" proceed to the next step. 

80 Reset PTFAIL and after nine minor cycles, examine BUTEST to 
determine if it is still latched. If BUTEST is "true" proceed to 
the next step. 

90 This portion of the automated sequencing of the preflight test 
program is with the system in backup. The PRI FAILED RESET 
button must now be pressed to continue the preflight test. 
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1 00 Set a software signal (PTFAIL) from FCEU 2 that commands 
the system to backup. After nine minor cycles, examine the 
hardware latch circuit of the backup lamp driver (BUTEST). 

If it is "true" proceed to the next step. 

1 1 0 Reset PTFAIL; after nine minor cycles, examine BUTEST to 
determine if it is still latched. If BUTEST is true proceed to 
the next step. 

1 20 All the preflight steps have successfully passed. Set the GO 
light and reset the fail inhibit flag (DETIHB). 

If not all the steps are passed, PTISTP will show the last successful 
test and PTSTEP will go to 120 with the NOGO light being set. When the 
preflight test switch is placed in the off position, PTSTEP will reset to 
zero, the GO/NOGO light will go out, and the latched error flags will reset. 

4.2 Manual Flight Control System - Backup 

The backup system is designed as a "get home" mode. It basically 
consists of two single-string and independent A and B analog controllers. 
The A backup system drives both power drive units (PDU) of the left 
midspan and right outboard flaps, and the inner PDU'S of the left and right 
inboard flaps. The B backup system drives both PDU'S of the left outboard 
and right midspan flaps, and the outer PDU's of the left and right inboard 
flaps. There is no backup control for the leading edge flaps. The leading 
edge stays braked in whatever position it was in when the backup mode 
was first entered. Details of the design are described in reference 4. 

An easy-on system is designed to suppress the flap command switching 
transients when the control is transferred from primary to backup. This is 
accomplished by driving first order filters with the current flap positions. 

An example for a single surface is shown in figure 13. When control is 
transferred to the backup system, the outputs of these filters are 
switched so that they are connected to the summing junctions to provide 
the initial flap command. The initial roll and symmetric commands are 
zeroed immediately after switching to the backup control. They are then 
faded to their requested values by 4 sec time constant easy-on filters. 
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Backup control functions are the flap switch, roll stick, and wing 
sweep. The backup system does not utilize pressure equalization between 
the primary and utility systems. 

4.2.1 PRIMARY/BACKUP switch. 

The primary/backup switch is located on the upper left side of the MAW 
panel. This is a 4-pole switch which provides a positive switch to the 
backup system OR gate. When the switch is in the primary position, the 
switching logic is armed to return to the primary system. 

4.2.2 Flap switch. 

The flap switch is used to command the trailing edge flaps to one of 
three positions: HALF - 10°, FULL - 18°, and RETRACT - 2’. (The inboard 
flaps go to the "faired" position of 1 .8°.) 

The backup system has a dedicated set of contacts to indicate the 
switch position. Two discretes are used for the HALF, and another two 
discretes for the FULL position. For example, if the switch is in the FULL 
position, a FULL discrete is input to the A backup and another FULL 
discrete is input to the B backup system. 


4.2.2.1 RETRACT: 

1 . The flaps move to a trailing edge position of 2° at a flap rate 
according to the filter 1/(4S + 1). 

2. The position accuracy is ± 0.5*. 

3. There is no annunciator light. 

4. The roll stick goes through a .625(S + 3)/(S + 8) lead-lag filter. 

4.2.2.2 HALF: 

1 . The flaps go to a trailing edge position of 1 0° at a flap rate 
according to the filter 1/(4S + 1). 

2. The position accuracy is ± 0.5*. 
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3. The HALF annunciator light will not illuminate unless the leading 
edge flaps are at 1 5° and the primary system is working. 

4. The roll stick goes through a .625(S + 3)/(S + 8) lead-lag filter. 

4.2.2.3 FULL: 

1 . The flaps go to a trailing edge position of 1 8° at a flap rate 
according to the filter 1/(4S + 1 ). 

2. The position accuracy is ± 0.5°. 

3. The FULL annunciator light will not illuminate unless the leading 
edge flaps are at 20’ and the primary system is working. 

4. The roll stick goes through a .625(S + 3)/(S + 8), lead-lag filter. 

4.2.3 Slew switches. 

Not available in the backup system. 

4.2.4 Rate select. 


Not available in the backup system. 

4.2.5 Roll trim. 

Not available in the backup system. 

4.2.6 Trim reset. 

Not available in the backup system. 

4.2.7 Manual command program. 

Not available in the backup system. 

4.2.8 Wing sweep inboard flap fairing. 

Wing sweeps aft of the 26’ detent are also available from the backup 
system. The sweep logic is shown in figure 14. To generate a SWP ENABLE 
discrete, the following procedure must be done: 
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1 . Put the flap switch in RETRACT. 

The RETRACT position in the backup mode positions the inboard flaps at 
the faired value of 1 . 8 °. 

2. Set the inboard brake. 

The INBKSW is OR'd with the CDGT26 in hardware to artificially set this 
discrete. This allows the path on the left side of the figure to be 
followed. If all four backup LVDT's are at 1 .8’ ±0.5”, then the INBRK and 
SWP ENABLE discretes will be set. 


3. Pull the sweep lever through the 26’ detent. 

When the wing sweep moves beyond 27”, the SWGT26 and actual CDGT26 
discretes are set. At this point, the INBRK would be latched even if the 
inboard brake switch (INBKSW) were released because of the other two 
discretes. However, the INBKSW should never be released for backup wing 
sweep aft of 26” because the brake would be released if both SWGT26 and 
CDGT26 were to fail to false states. The flap switch can be placed in 
either HALF or FULL if desired at this point. The FAIRED light will not 
illuminate for backup sweeps because the fairing request discrete which 
comes from the primary system is not set during this procedure. 

4. To release the fairing logic, set the sweep lever forward to the 26’ 
detent and reset the inboard brake. The INBRK and SWP ENABLE discretes 
are reset to "false" at this point. 


4.2.9 Flap rate limits. 

Rate limiters are used to help prevent overspeeding the power drive 
units (PDU's). The maximum rate of change in the servo commands for each 
flap pair is shown below. 


CONTROL SURFACE 
LEADING EDGE 
INBOARD 
MIDSPAN 
OUTBOARD 


RATE LIMIT 

NOT DRIVEN IN BACKUP 
30 deg/sec 
40 deg/sec 
40 deg/sec 
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4.2.1Q S ur fa ce po sitio n a ccura cy^ 


The total error from the command source to the actual surface position 
(as measured by a protractor), which includes all error sources from the 
analog and digital components, is less than 0.5°. 

4.2.11 HOME command. 

Not available in the backup system. 

4.2.12 Ground roll brake. 


Not available in the backup system. 

4.2.13 Flap position limits. 

The backup system has the same protection to reduce the possibility of 
a mechanical stop strike as the primary system. The backup system has 
slightly different electrical limits than the primary software limits. 

They are also a function of the flap position. Position limits do not apply 
for the leading edge flaps since they cannot be driven by the backup 


system. 




MECH 

RETRACT 

HALF 

FULL 

INBOARD 

-up 

-2.60 

-0.63 

-0.63 

-0.63 


- dn 

19.00 

17.48 

17.48 

17.48 

MIDSPAN 

-up 

-2.35 

-0.17 

-0.17 

1.19 


- dn 

21.00 

19.15 

19.15 

19.15 

OUTBOARD 

-up 

-2.53 

-0.12 

-0.12 

1.06 


- dn 

20.83 

19.18 

19.18 

19.18 


4.2.14 QC scheduling. 

There are two impact pressure (QC) probes on the airplane which are 
filtered, 2/(S + 2) to suppress the noise and averaged (QCAVE). This signal 
is used to limit the downward deflection for the MAW TE flaps and to 
schedule the roll stick gain (fig. 10). 
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4.2.14.1 QC TE limiter: 


For a QCAVE that is less than 830 lb/ft 2 , there is no QC TE limiting. If 
QCAVE is between 830 and 1360 lb/ft 2, the TE is QC-limited linearly from 
21 to 4*. For a QCAVE greater than 1360 lb/ft 2, the TE limit is fixed at 
4°. 

4.2.14.2 Roll stick gain: 

If the QCAVE signal is less than 150 lb/ft 2 , the gain stays at 100 
percent. If the QCAVE is between 150 and 250 lb/ft 2 , the gain decreases 
linearly from 1 00 percent to 27 percent. For a QCAVE greater than 250 
lb/ft 2 , the gain remains at 27 percent. 

4.2.15 LE RESET/ENGAGE/BRAKE switch. 

The leading edge flaps may be manually braked by setting the switch to 
the BRAKE position. This causes the brakes to be engaged and the LE 
BRAKE light illuminated. The system stays in primary, but all leading edge 
flap commands are ignored. The brakes can be released in two ways: 

1 . Put the switch to RESET and then back to ENGAGE, or 

2. Put the switch to ENGAGE and press the PRI FAILED RESET button. 

The leading edge flaps are also braked whenever the system is in the 
backup mode or a leading edge failure is detected. Failures related to the 
leading edge are discussed in section 5. 

4.2.16 A ENGAGE/BRAKE switch. 

The left midspan and right outboard flaps may be manually braked by 
setting the A switch to the BRAKE position. This will illuminate the A 
BRAKE light and also cause the system to downmode to the backup system. 
The primary mode cannot be engaged with the switch in the BRAKE 
position. To release the brakes, put the switch in the ENGAGE position. 

The brakes automatically set if the system is in the backup mode and a 
failure is detected in either the left midspan or right outboard flaps, or in 
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the A stick transducers or the A backup power supply. In this case the A 
STATUS light is also illuminated, and a latch is set to hold the brakes. To 
release the brakes in this situation the following must be true: 

1 . The A BRAKE switch is in the ENGAGE position. 

2. There are no A backup failures. 

3. The A STATUS button is pressed. 

4.2.17 B ENGAGE/BRAKE switch. 

The left outboard and right midspan flaps may be manually braked by 
setting the switch to the BRAKE position. This illuminates the B BRAKE 
light and also causes the system to downmode to the backup mode. The 
primary mode cannot be engaged with the switch in the BRAKE position. To 
release the brakes put the switch in the ENGAGE position. 

The brakes will be set automatically if the system is in the backup 
mode and a failure is detected in either the left outboard or right midspan 
flaps or the B backup power supply. In this case the B STATUS light will 
also be illuminated. A latch to hold the brakes has occurred. To release 
the brakes in this situation the following must be true: 

1 . The B BRAKE switch must be in the ENGAGE position. 

2. There are no B backup failures. 

3. Press the B STATUS button. 

4.2.18 1NBD ENGAGE/BRAKE switch. 

The left and right inboard flaps may be manually braked by setting the 
switch to the BRAKE position. This will illuminate the INBD BRAKE light 
and also cause the system to downmode to backup mode. The primary mode 
cannot be engaged with the switch in the BRAKE position. To release the 
brakes, put the switch in the ENGAGE position. 

The brakes will be automatically set and latched if the system is in the 
backup mode and a failure is detected with either inboard flap. In this 
case the INBD STATUS light will also be illuminated. To release the 
brakes in this situation the following must be true: 
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1 . The INBD BRAKE switch is in the ENGAGE position. 

2. There are no inboard flap backup failures. 

3. The INBD STATUS button is pressed. 

The inboard flaps are also automatically braked, as previously 
mentioned in the wing sweep description, whenever the sweep is aft of 
26°. This braking command comes from either the primary or the backup 
system, depending on which mode is active. The brake command cannot be 
released until the wing is positioned further forward than 26'. 

5.0 FAILURE MONITORING AND REDUNDANCY MANAGEMENT 

Failure monitoring is described in ref. 5. The monitoring can be divided 
into those failure discretes set by the primary system and those set by the 
backup system. Primary system failures can be grouped into two 
categories: (1) system stays in primary and, (2) system downmodes to 
backup. Backup system failures can also be grouped into two categories: 
(1 ) do not set brakes and, (2) set any combination of A, B, or INBD brakes. 

PRIMARY FAILURES 


STAY IN PRIMARY 

1 . Any LE failure - set LE brakes 

2. QC - fixed roll gain and TE limit 

3. Ideal model - LE and roll flaps 

4. IDENT discrete 


DOWN MODE TO BACKUP 

1 . Command - except LE 

2. Selected output discretes 

3. Ideal model - inboard flaps only 

4. Delta pressure (force fight) 

5. Roll stick 

6. Power supply 

7. Hydraulic pressure < 1200 lb/in^ 

8. Computer executive error 

9. Watchdog timer 


BACKUP FAILURES 


DO NOT SET BRAKES 

1 . Aliveness monitor 

2 . QC - fixed roll gain & TE limit 


SET A. B. AND/OR INBD BRAKES 

1 . Valve current 

2. Position limit 
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3 . Single hydraulics 3. Power supply 

4. Ideal model (flaps HALF/FULL) 4. Roll stick 

5 . IDENT discrete 5. Ideal model (flaps RETRACT) 

For the situation of a backup failure while the system is in the backup 
mode, the affected backup channel will set the brakes to the flap pair 
driven by that system, while the other channel will continue to function 
normally. The inboard flaps will continue to function with only one backup 
channel because the failed channel will open the bypass valves to allow 
the functioning channel to move the flaps. 

There is no failure testing done on any input discretes. For example, 
assume the flap switch has a faulty primary contact at the FULL position. 
When the switch is put in FULL, one primary channel will try to drive the 
flaps to the FULL position while the other primary channel will not receive 
the FULL input discrete and the flap command will be in the RETRACT 
position. This will cause a command difference between the two primary 
computers which will result in a downmode to the backup system. For 
details on the MAW failure annunciators and the possible implications on 
the flight control system, refer to the Appendix. 

5.1 Failure Monitors - Primary System 

A fail flag is set only after the fail condition has exceeded a time delay 
threshold. There are two types of fail flags: latched and unlatched. Once 
a latched fail flag is set, it stays in memory until the power switch is 
cycled or the preflight test has been run. A monitor can be connected to 
the FCEU in order to read the latched fail discretes since they are not 
available on the cross channel data bus. 

The unlatched fail flags are set only as long as the failure exists. 

Some unlatched flags are reset if the system downmodes to backup. This 
allows the system a chance to reengage the primary without preexisting 
failures ready to trigger another downmode. The unlatched fail flags are 
available for monitoring on the cross channel data bus. 

Failure monitors are provided for the following signals: 
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1 . All analog outputs 

2. Selected discrete outputs 

3. Differential motor pressures for each surface 

4. Selected analog input signals 

5. Wing surface position model 

6. Leading edge left and right differential position 

7. Other modules within the processor 

8. Flags set from the other processor 


5.1.1 Analog output commands. 

The commands between the FCEU's are compared. If they differ by more 
than 1 .5* for 0.2 sec or longer, a fail flag is set and the system 
downmodes to backup. 

MNEMONIC THRESHOLD. DEG TIME DELAY. SEC 


FCLLE 

1.5 

0.2 

FCRLE* 

1.5 

0.2 

FCLOUT 

1.5 

0.2 

FCLMID 

1.5 

0.2 

FCLIN 

1.5 

0.2 

FCRIN 

1.5 

0.2 

FCRMID 

1.5 

0.2 

FCROUT 

1.5 

0.2 


* LE brakes only - no downmode 


5.1.2 Output discretes. 

A test of common output discretes of the FCEU's is made. If these 
discretes differ for 0.3 sec or longer, a fail flag is set and a downmode to 
backup is generated. 


MNEMONIC 

TIME DELAY. SEC 

MNEMONIC 

TIME DELAY.SEC 

FEXDOG 

0.3 

R30J- 

0.3 

FANGFOLt 

0.3 

FANFAIRt 

0.3 

FMASTER* 

0.3 

FTRANST 

0.3 
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FFALHLD 

0.3 

FVALIDt 

0.3 

FTRMNUL* 

0.3 

FBRKHLD 

0.3 

FNOGO 

0.3 

FONTEST 

0.3 

FANTOFFf 

0.3 

FANLANDf 

0.3 

FANQC* 

0.3 

FANSW45* 

0.3 

FMLC* 

0.3 

FMAN* 

0.3 

FCCC* 

0.3 

FDL* 

0.3 

FMCC* 

0.3 

FDLGA* 

0.3 

FSPAN2* 

0.3 

FSPAN1* 

0.3 

FAUTVAL* 

0.3 

FAUTENT* 

0.3 

FINBRAKf 

0.3 * DISABLED t NULL TEST 


5.1.3 Differential pressures. 



Differential pressure transducers are provided for each of the 16 wing 
surface drive motors. The absolute value of the difference between the 

two FCEU's is compared to a 3600 lb/in^ 

threshold. If the delta pressure 

exceeds this threshold for 0.06 sec or more, a differential pressure fail 
flag is set and a downmode to backup is generated. Once in the backup 
mode, the delta pressure fail flags are reset after a time delay of 

200 msec. 

These monitors are not activated until after 200 msec, once 

the primary mode is reengaged. 



MNEMONIC 

THRESHOLD. PSI 

TIME DELAY. SEC 


FDPROU 

3600 

0.063 


FDPRMI 

3600 

0.063 


FDPRLE* 

3600 

0.063 


FDPRIN 

3600 

0.063 


FDPLOU 

3600 

0.063 


FDPLMI 

3600 

0.063 


FDPLLE* 

3600 

0.063 


FDPLIN 

3600 

0.063 



* LE brakes only - no downmode 


5.1.4 Roll stick. 

The roll stick input tor the primary system is dual. Each FCEU gets its 
own roll stick command. The failure detection logic compares these 
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inputs, and if the absolute value of the difference exceeds a threshold for 
more than the time delay, a downmode to backup will result. A failure flag 
will be set to indicate the reason for the downmode. 

MNEMONIC THRESHOLD TIME DELAY 
FRSTIK 0.8 VOLTS 0.2 SEC 


5.1 .5 Impact pressure. 

The impact pressure input for the primary system is dual. Each FCEU 
gets its own impact pressure signal. The failure detection logic compares 
these inputs, and if the absolute value of the difference exceeds a 
threshold for more than the time delay, an impact pressure fail 
annunciator will illuminate and the corresponding fail flag will be set. 

The system, however, will stay in primary. 

For an impact pressure failure, the TE down-deflection limit and roll gain 
schedules (fig. 1 1) are determined as follows: 


RETRACT - The symmetric command will drive to 2 ° at 2 deg/sec. 

If symmetric slewing had been applied at the time of 
the failure, the trailing edge flaps will drive to 4° at 
4 deg/sec and then to 2° at 2 deg/sec. The trailing 
edge flaps will be limited to 4° TED. The roll stick 
gain will be fixed at 27 percent. 


HALF/FULL 


The flaps will remain at the commanded flap switch 
posiiion and fuii roii authority will be allowed. The 
roll stick gain will be fixed at 1 00 percent. 


An impact pressure failure also locks out the manual command program 
slewing. 


MNEMONIC THRESHOLD TIME DELAY 

FQIMPF 100 lb/ft 2 0.5 sec 

* no downmode 
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5.1.6 Ideal position model. 

The actual flap position for each MAW surface is compared with an 
ideal model to determine if the flap is at the expected position. The 
leading edge and inboard flaps are handled differently than the midspan 
and outboard flaps. 

The LE and INBOARD MAW flap positions from the primary LVDT’s are 
compared with a 22 rad/sec first order model in order to predict the 
positions. If the predicted position disagrees with the actual position by 
5° or more for at least 0.2 sec, a position error flag discrete is generated 
which causes a downmode to backup. The model fail flags are reset in the 
backup mode after a delay of 200 msec. These monitors are not activated 
until 0.2 sec once the primary mode is reengaged. 

The MIDSPAN and OUTBOARD flap positions from the primary LVDTs are 
compared with a second order model (f n = 27 rad/sec; damping = 0.60; and 

20 msec time delay). If the predicted positions disagree with the actual 
positions by 5° or more for at least 0.2 sec, a position error flag discrete 
is generated. This does not cause a downmode to backup. These model fail 
flags cause the MAW CAUTION light to flash only during the time the 
failure is being declared. 


MNEMONIC 

THRESHOLD. DEG 

TIME DELAY. SEC 

FPROUT 

5.0 

0.2 

FPRMID* 

5.0 

0.2 

FPRLEf 

5.0 

0.2 

FPRIN 

5.0 

0.2 

FPLOUT* 

5.0 

0.2 

FPLMID* 

5.0 

0.2 

FPLLEf 

5.0 

0.2 

FPLIN 

5.0 

0.2 


* no BACKUP downmode (MAW CAUTION light) 
f LE brakes only 


5.1 .7 Leading edge differential position. 

The absolute value of the difference between the left and right leading 
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edge positions is compared. If this difference exceeds 3.0° for 0.06 sec or 
more, a fail discrete (FLEDIF) is set. This will result in the leading edges 
being braked for the remainder of the flight. The system will not go to 
backup for this failure. This failure can only be reset on the ground. The 
latched error fail (XFLEL) on the cross channel is set. 

5.1 .8 Other modules within the processor. 

The following is a description of executive type fails. 


MNEMONIC 

FROLLF 

DESCRIPTION 

Set by the ROLL MODULE to indicate a lead-lag filter 
overflow condition. 

FCDACT* 

Set by the SERVO ACTUATOR MODULE. 

FCDINT 

Set by the INTEGRATOR MODULE to indicate 
initialization overflow of position (mid or outboard) + 
ROLCOM for midspan or outboard surfaces. 

FCOMMD* 

Set by the COMMAND MODULE. 

FOUTPT* 

Set by the OUTPUT MODULE. 

FIN PUT* 

Set by the INPUT MODULE if any of the following three 
synchro inputs have overflowed into the high order word: 
WSPOS, THETA, ROLPOS. 

FEWDOG* 

External watchdog failure. 

FIWDOG* 

Internal watchdog failure. 

FSYNCR* 

Synchronization failure. 

FCOMUN* 

Communication failure. 

FCKSUM 

Set by the EXECUTIVE MODULE in the background during 
self test in WAITE1 (20 msec wait loop). This discrete 
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sets FATFAL in the CONTROL FIELD byte. 


* DISABLED 



The following flags are set in the CTLFLD byte: 

MMEMONC DESCRIPTION 

SYNCBT Sync bit. Always zero in this buffer to distinguish the 

CTLFLD byte from the sync byte (53H) which replaces it 
in the sync message. 

XFLEL Leading edge latched (from other processor) flag. The 

FLED IF fail flag is set in the other processor. 

CVRRUN Set by the EXECUTIVE MODULE to indicate that a frame 

overrun has occurred. 

FATFAL Fatal fail set by the EXECUTIVE MODULE from the 

following tests: 

1. MEMTST/RAMTST - in power up self test. Address 
of defective cell save in MEMADR. 

2. CHKSUM - background during self test in WAITE1 
(20 msec wait loop) if CHKSUM incorrect 

3. RTINT - If TFSYNC is set. 

4. RTINT - If MONREQ is set. 

5. RTINT - If OVRRUN is set. 

6. BADINT - If bad interrupt is detected. 

7. BREAK2 - If illegal instruction is detected. 
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8. NMINT2 - Executive NM1 routine. 


9. WHYINT - Set by exec system call routine. 

TFSYNC Synchronization failure. Set by the synchronization 

module (MDSYNC) if the processors get out of sync by 
more than 1 20 micro sec. 

CWVICN OK to go to the monitor. Set by the preflight test module 

(MDPFT). The following discretes are set: IDLE, ONGEAR, 
and PFT switch is in "on" position. 

M3SFEQ Monitor request. Set by the executive when FATFAL is 

set. 

TTCON Terminal connected. Set by the executive routine. 

5.1.10 Ident flag. 

The two FCEU's are differentiated from each other by the grounding of a 
pin to a box 1 connector. This provides an input discrete, IDENT, which is 
set to "1 " for box 1 , and "0" for box 2. The FCEU's interpret this as channel 
1 and channel 2, respectively. The primary system reads an initialization 
value of the IDENT discrete at power-up. If they are the same, a F1DENT 
fault is set. The IDENT discrete is also tested real time so that a 
difference after power up is detected. A flashing IDENT light on the C&D 
panel will result whenever a FIDENT fault is declared. The MAW CAUTION 
light will also flash. 

The primary system is designed to maintain proper flap phasing after 
an IDENT fault. However, in the backup system the rolling flaps driven by 
the faulted IDENT discrete will be in the opposite direction for roll stick 
inputs. For example, if the IDENT discrete went from "1 " to "0" in channel 
1 and the backup system was entered, the "A" backup roll flaps (left 
midspan and right outboard) would be opposite in direction for roll inputs. 
This would cancel out the normal roll control and cause the MAW roll 
surfaces to act like a speed brake for roll inputs. 
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5.2 Failure Monitors - Backup Hardware. 

The backup hardware electronics does its own fault testing which is 
independent of the primary system. A failure in the backup system would 
not cause a downmode from a good primary system, but if a downmode did 
occur, brakes would be set automatically in the failed backup system. The 
following backup tests are being performed while the system is in 
primary: aliveness monitor, backup power supply, roll stick monitor, 
surface model, and valve current mismatch test. When the backup mode is 
entered, the position limit test is added to the above set. 

Failure monitors are provided for the following signals: 

1 . Valve current comparison 

2. Aliveness monitor comparison 

3. Analog inputs 

4. Position model 

5. Position limits 

6. Power supply monitor 

7. Hydraulic pressure monitor 

8. Watchdog time out 

9. A STATUS light 

10. B STATUS light 

11. INBD STATUS light 

12. MAW CAUTION light 

5.2.1 Valve current comparison. 

The valve current comparitors check for mismatch of PDU commands 
coming from the same backup channel. These discretes cycle at a 
frequency of 8.7 Hz with a pulse width of 60 msec. 

For example, an INVMON fail flag in channel 1 would be set if the 
backup A generated an inboard flap command difference between the left 
inboard flap PDU number 10 and right inboard flaps PDU number 1 1 of 5 
milliamps or greater for at least 0.1 15 sec. An INVMON fail will not set 
the inboard brake or the INBD STATUS light. 
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MNEMONIC 

INVMON* 

OMVMON 


THRESHOLD 

5 mamp 
5 mamp 


TIME DELAY 

0.1 15 SEC 
0.115 SEC 


* does not set inboard brakes 


5.2.2 Aliveness monitor comparison. 


The aliveness monitor is a test of the backup system while flap control 
is being driven by the primary system. This test checks for a mismatch 
between the output signals generated by identical electronics in the A and 
B backup systems of the right outboard and midspan flaps, left outboard 
and midspan flaps, and the left and right side of each inboard flap. An 
outboard/midspan aliveness monitor fault will set both A and B STATUS 
lights. Once the backup system is entered, the aliveness monitor is 
disabled. These discretes cycle at a frequency of 0.51 Hz with a pulse 
width of 130 ms. 

An OMLIVE fail flag in channels 1 and 2 would be set if the backup A and 
B commands to the right midspan and right outboard flaps, for example, 
disagreed by greater than 0.5 volts for at least 1 .96 sec. 


MNEMONIC 

INLIVE 

OMLIVE 

MIDMRF 

OuTTvIRF 


THRESHOLD 
0.5 volts 
0.5 volts 
0.5 volts 
0.5 volts 


TIME DELAY. SEC 
1.96 
1.96 

NO DELAY 
NO DELAY 


5.2.3 Roll stick. 


Two dedicated roll stick transducers are used by backup A and another 
two are used by backup B system. If the absolute of the difference of the 
roll stick inputs within a system exceeds the threshold of 0.8 volts or 
more, then that backup system will be braked. Flaperon roll control will 
be driven from the other backup system only. 

MNEMONIC THRESHOLD TIME DELAY 

STKMON 0.8 VOLTS NO DELAY 
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5.2.4 Impact pressure. 

The nose and side impact pressure probes used for the primary system 
are also brought into both the A and B backup systems. 

MNEMONIC THRESHOLD TIME DELAY 
QCFAIL (LIGHT) 100 lb/ft 2 1 .96 sec 

5.2.5 Position model. 


The backup system does its own model testing independent of the 
primary system. However, if the system is in the primary mode, the input 
to the backup model is the surface position rather than the flap command. 
The model and logic for the inboard flap is different from the model and 
logic for the midspan and outboard flaps. 

The inboard flap position is compared with a 22 rad/sec first order 
model in order to predict the positions. If the prediction disagrees with 
the actual position by 5° or more for 0.13 sec or more, then both inboard 
flaps will be braked. 


The midspan and outboard flaps are compared with a second order 
model (f n = 24.9 rad/sec, damp = 0.47). If the predicted position disagrees 

with the actual LVDT position by 5° or more for 0.13 sec or more, then 
either the A or B brakes will be set, depending which system is setting 
the error, if the flaps are in the RETRACT position. If the flap switch is in 
either HALF or FULL, then the A or B STATUS light will illuminate only 
while the model fault is being declared. Whenever a brake is being set, the 
MAW CAUTION light will also flash. The table below shows the brake and 
STATUS light logic for each flap position. 


FLAPS INBOARD 

RETRACT INBD BRAKE 

HALF INBD BRAKE 

FULL INBD BRAKE 


MIDSPAN OUTBOARD 
A/B BRAKE A/B BRAKE 
A/B STATUS A/B STATUS 
A/B STATUS A/B STATUS 


The inboard and out/mid model faults (INMODL and OMMODL) cycle at a 
frequency of 7.7 Hz with a pulse width of 60 msec. 
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MNEMONIC 

INMODL 

OMMODL 

MIDMRF 

OUTMRF 


THRESHOLD. DEG TIME DELAY 
5 0.13 SEC 

5 0.13 SEC 

5 NODELAY 

5 NODELAY 


5.2.6 Position limits. 


The down deflection limit of the trailing edge flaps is scheduled with 
QC pressure so that the actuator limit load will not be exceeded. The 
surface position limit test is not computed while the system is in the 
primary mode so that QC schedule differences (particularly in the 830 to 
1 360 lb/ft 2 range between the primary and backup systems) will not 
cause a limit fault to be set. These discretes cycle at a frequency of 8.7 
Hz with a pulse width of 60 msec. 


If the flap position exceeds the trailing edge limit by 1 .9° or more for 
at least 0.1 1 5 sec, then a limit fault will be generated. It is only possible 
to generate a position limit monitor fault while the TE flaps are being 
driven with the QC limiter (QC > 830 lb/ft 2 ). The reason is because the 
1 .9* threshold is beyond the normal full mechanical limits. 

MNEMONIC THRESHOLD TIME DELAY 
INPOSL 1.9* 0.115 SEC 

OMPOSL 1.9’ 0.115 SEC 

5.2.7 Power supp l y monitor. 

Electrical power to the FCEU's is supplied by four sources. For FCEU 1 
the power comes from the right engine MAIN BUS and the ENGINE START 
BATTERY BUS. For FCEU 2 the power comes from the left engine 
ESSENTIAL BUS and the MAW FCS BATTERY. A single generator from either 
engine can supply all the electrical demands, therefore, in the event of a 
generator failure the circuits will automatically switch-in to the 
remaining good generator. 

The primary (ch 1 and 2) and backup (A and B) systems each have 
independent power supplies. There is a continuous monitor of each power 
supply so that if a primary power supply fails, the system will 
automatically downmode to the backup system. Should the power supply 
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fail in one of the backup systems, the flaps associated with that system 
will be braked. The other backup system will continue to drive the 
remaining flap set. 

MNEMONIC THRESHOLD TIME DELAY 

PRIPWR ± 5% of 5 volts 1 3 msec 

± 5% of ± 1 5 volts 1 3 msec 

± 5% of 26 vac/400 Hz 34 msec 

B U P W R ± 5% of 5 volts 1 3 msec 

± 5% of ± 1 5 volts 1 3 msec 

± 5% of 26 vac/400 Hz 34 msec 


5.2.8 Hydraulic pressure monitor. 

The primary and utility hydraulic pressures are monitored. If the 
pressure drops below 1200 lb/ft 2 , that system is declared failed and the 
FCS down modes to the backup system. The PDU's driven by the failed 
hydraulic system are commanded to the bypass position and the flaps are 
driven by the functioning hydraulic system only. 

MNEMONIC THRESHOLD. Ib/in. 2 TIME DELAY 

PH YDOF pri hydr press < 1 200 0.45 RAD/SEC FILTER 

UHYDOF utl hydr press < 1 200 0.45 RAD/SEC FILTER 

5.2.9 Watchdog timeout. 

A watchdog timer must be reset every frame (20 msec). If this timer 
is not reset within 30 msec, a watchdog timeout failure will be declared 
and a downmode will occur. 

MNEMONIC THRESHOLD 
WDOGTO 30 msec 

5.2.10 A status lig ht. 

The A STATUS light is latched to indicate failures associated with the 
A backup system. If the backup mode is entered while the A STATUS light 
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is lit, the left midspan and right outboard flaps are braked unless the light 
is set by the aliveness monitor flag (OMLIVE) from channel 1 . The logic to 
set the light is described below. 

A STATUS LIGHT = STKMON + OMVMON + OMMODL + BUPWR + (OMPOSLBU) 

+ (OMLIVE'BD) 

These fail flags are all associated with channel A of the backup system. 

The light may be reset if the failure no longer is declared and the status 
button is pressed. 

5.2.11 B status lig ht. 

The B STATUS light is latched to indicate failures associated with the 
B backup system. If the backup mode is entered while the B STATUS light 
is lit, the left outboard and right midspan flaps are braked unless the light 
is set by the aliveness monitor flag (OMLIVE) from channel 2. The logic to 
set the light is described below. 

B STATUS LIGHT = STKMON + OMVMON + OMMODL + BUPWR + (OMPOSL'BU) 

+ (OMLIVE'BU) 

These fail flags are all associated with channel B of the backup system. 
The light may be reset if the failure no longer is declared and the STATUS 
button is pressed. 

C O -to QT ATI IQ I!mM 

mwarcf Oi A i Ilyin. 

The INBD STATUS light is latched to indicate failures associated with 
the inboard flap. The light may be set from either A or B or both backup 
systems. If the backup mode is entered while the INBD STATUS light is lit, 
the left and right inboard flaps will be braked unless the light was set by 
the aliveness monitor flag (INLIVE) from either backup channel. The logic 
to set the light is described below. 

INBD STATUS LIGHT = INMODL + BUPWR + INPOSL + (INLIVE BU) 
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5.2.13 MAW CAUTION light. 


The MAW CAUTION light is latched to indicate failures which originate 
from either the primary or the backup systems. The logic to set the light 
is described below. 

MAW CAUTION = A STATUS + B STATUS + INBD STATUS + MASTER + BRAKE 
TEST PLUG 

where MASTER = PFT SW ON + IN MONITOR PRG + FALHLD + BRKHLD 
+ FPLOUT + FPLMID + FPRMID + FPROUT 
The MAW CAUTION light can always be reset, even if the failure is still 
present, unless the preflight test switch is in the "on” position, or the 
monitor program has been entered, or the brake test plug is installed. 

6.0 FLAP DRIVE SYSTEM 

The basic MAW flap actuation system consists of a hydraulic motor, 
gear reduction box, electric brake, rotary actuator, control module, and 
torque tube. The motor, gear box, servo control valve, and brake are housed 
in a single module called a power drive unit (PDU). There are two PDU's 
per surface. The servo control valve and electrical position feedback 
complete the loop in the servo system. 

6.1 Servo Electronics. 

The servo electronics (refs. 6 and 7) provide signals to the valve for 
each PDU. These signals consist of a command, block, bypass, and brake. 
There are separate electronics for the primary and the backup systems so 
that a failure in one would not affect the other. The backup servo 
electronics perform various fault monitoring tests. 

6.1.1 Command path. 

A simplified block diagram of the servo feedback loop for a roll flap is 
shown in figure 1 5. The commands are received from whichever system is 
controlling the flaps (primary or backup) and generates a signal to the 
valve at each PDU. Each primary channel drives a single PDU for a given 
flap. The primary servo command consists of an error signal between the 
FCEU command and the actual flap position, plus the same error from the 
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other channel for position equalization, plus pressure equalization. The 
backup servo command receives a single dedicated backup LVDT feedback. 

It does have the position or pressure equalization loops. 

6,1 .2 Equalization loops. 

Two equalization loops are used in the dual channel system to minimize 
the inherent force fight that develops between two high pressure gain 
servos that are driving common output shafts in parallel. One loop 
provides position error equalization and the other is used for pressure 
equalization. 

The purpose of the position error equalization loop is to reduce force 
fight by providing identical actuating error signals to both servo 
amplifiers. Position equalization corrects for the force fight that is 
introduced by unequal position command and/or unequal position 
transducer outputs within a 2.6* limit. 


The purpose of the pressure equalization networks is to minimize the 
amount of force fight between the two servo loops due to the inherent 
servo valve driver amplifier offsets and the bias offset currents of the 
two servo valves. The command and position equalization will not account 
for the tolerances of the servo valve driver amplifier and the servo valves, 
without these pressure equalization networks. 

6.1.3 Block, bypass, and brake logic. 

Each PDU can receive four types of commands: servo valve, block, 
bypass, and brake (fig. 1). The servo valve has already been explained. 
MAW surfaces are braked by first issuing a block command. The block 
signal is used to slow the hydraulic motor speed to under 500 rpm 
(2 deg/sec flap rate). The brake command is delayed 1 20 msec after the 
block command. This physically locks the motor by meshing gear teeth 
from the brake. 

The bypass command is used to open the PDU valve so that it can be 
driven by its companion PDU only. An example is a hydraulic failure, where 
all the TE PDU's would go to the bypass mode for that failed system and 
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the drive would be from one side from a single PDU per flap. Logic for the 
block, bypass, and brake commands follow: 

BLOCK^ = BU* (OMVMON + OMMODL + OMPOSL + STKMON + BUPWR) 

+ A(B)BKSW 

BLOCK )NB = BU*(INMODL + INPOSL + BUPWR) + INBKSW 
+ INBRK(wing sweep) 

BLOCK le = BU + FCLLE + FCRLE + FDPLLE + FDPRLE + FPLLE + FPRLE 
+ FLEDIF + LEBKSW 

BRAKE = 1 20 msec delay after BLOCK 
BYPASSa/b/inb = PHYDOF + UHYDOF 
BYPASS le = not available 

6.2 Torque Shaft and Rotary Actuator 

The flap drive mechanism is completed by the use of torque shafts and 
rotary actuators. The rotary actuators are attached to the front of the 
wing box and to an auxilary spar bolted to the rear of the wing box. A 
linkage is attached from the rotary actuator to the flexible fiberglass 
panels. The torque shafts link the rotary actuators and the PDU's for a 
given flap. This arrangement can allow for considerable wing flexing 
without jamming any part of the mechanism. 
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Figure 1 . Power drive unit. 
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NOTES: (1 ) The signal flow is a 2 way path. (2) No. - PDU number 

from FCEU - commands (3) P - primary hydraulics 

to FCEU - AP, LVDT's U - utility hydraulics 


Figure 2. System architecture - Primary FCS. 


41 
















2 

3 

P 

P 


RIGHT L£ 



LEFT OUT LEFT MID LEFT INB 


RIGHT INB RIGHT MID RIGHTOUT 


NOTES: (1 ) The signal flow is a 2 way path, 
from FCEU - commands 
to FCEU - LVDTs 


(2) No. -PDU number 

(3) P - primary hydraulics 

U - utility hydraulics 


Figure 3. System architecture - Backup FCS. 



















Figure 4. Roll stick architecture. 
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Figure 5. Flap switch architecture. 
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Figure 6. MAW commands (roll/symmetric). 
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Figure 8. MAW control and display panel. 
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Figure 10. Roll gain and TE deflection limit schedules with QC 
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Figure 1 1 . Roll gain and TE deflection limit schedules with QC fail. 
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Figure 12. Preflight test flow diagram. 
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Figure 12. Preflight test flow diagram - continued. 
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Figure 12. Preflight test flow diagram - continued. 


51 


IDLE PATH 










A F EC 



Figure 12. Preflight test flow diagram - continued. 
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Figure 1 2. Preflight test flow diagram - continued. 
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Figure 1 2. Preflight test flow diagram - concluded. 
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Figure 14. Wing sweep logic - Backup system. 
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Figure 15. Servo feedback electronics. 


56 











APPENDIX ■ MAW FAIL ANNUNCIATOR DESCRIPTION 


This appendix contains details of the MAW panel annunciator light 
interpretation. The flight control system redundancy management for both 
primary and backup and possible failures to generate these situations are 
discussed. 


Primary Failures - Stay in Primary 

1 . Annunciation - QC FAIL 
Redundancy management - 

(a) Flap switch in HALF or FULL - fix the roll gain at 1 00 percent 
and allow full authority for the TE flaps. 

(b) Flap switch in RETRACT - fix the roll gain at 27 percent and 
set the TE flap limit at 4* down. If the TE flaps have been 
slewed down, they will drive to 2’. 

Possible failures/causes - 

(1 ) AQC probes differ by 1 00 lb/ft 2 . This could be caused by 
unusual airplane manuvering. Failure is resettable if the 
probes agree within 100 lb/ft 2 . 

2. Annunciation - LE BRAKE 

MAW CAUTION (flashing) 


Redundancy management = 

Set Leading Edge brakes in current position. 

Possible failures/causes - 

(1 ) Flap position - A3* difference between the left and right LE 
positions. (This can be confirmed by the LE cockpit meters.) 
This failure is not resettable. This could be caused by any of 
the four LE brakes or the four blocking valves sticking in any 
one of the LE flap PDU's. 

(2) Flap command - A1 .5’ difference between channel 1 and 2 
commands. This could be caused by an LE command input 
discrete difference, such as, an open LE SLEW discrete. 
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(3) Flap ideal model - A5° error between the LE ideal flap position 
model and the actual position. This could be caused by an open 
or nonfunctioning leading edge LVDT (any one of 4). 

(4) Servo differential pressure - Ap > 3600 lb/ft 2 of force fight 
across an LE flap surface. This could be caused by a stuck LE 
brake, blocking valve, failed Ap transducer, or binding in the LE 
linkage. The Ap is the difference between ch 1 and 2 for a 
given flap surface. 


3. Annunciation - MAW CAUTION (flashing) 

Redundancy management - 
None. 

Possible failures/causes - 

Flap ideal model - A5’ error between any mid or outboard flap 
ideal position model and the actual position. This could be caused 
by an open or nonfunctioning roll flap LVDT. Also, continued and 
rapid roll stick cycling causes the hydraulics to bleed down, 
contributing to the error between the ideal model and the actual 
position. 

4. Annunciation - IDENT (flashing) 

MAW CAUTION (flashing) 

Redundancy management - 

None in the primary system. The power-up IDENT values are used 
for differentiation purposes. The new input IDENT discretes are 
monitored and a FI DENT fault is set whenever the discretes are the 
same (both false or both true). 

If the backup system is entered, the roll flaps commanded from the 
faulted IDENT FCEU will be opposite in direction during roll stick 
inputs. This effect will neutralize the MAW rolling control and 
instead produce a speedbrake effect. The only roll control will come 
from the stabilator. 

CAUTDON - The faulty IDENT discrete can be determined immediately 
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from TM data to the control room, however, if the TM is unavailable 
and it is neccessary to fly in the backup system, the pilot must set 
the brake in the failed backup system. If the good backup system is 
braked, the remaining backup channel will produce opposite flaperon 
roll control. This could be catastrophic because the differential tail 
might be overpowered by the two remaining flaperons. The failed 
backup system can be determined by applying roll control and 
observing which flaperon set is opposite to the stick commands. 

Possible failures/causes - 

The IDENT discrete in both FCEU's are receiving the same value. 
This could result from the following causes: (1 ) the IDENT wire to 
channel 1 breaks, (2) IDENT wire to channel 2 is grounded, (3) discrete 
converter failure in either FCEU fails. 

Primary Failures - Downmode to Backup 

1. Annunciation- LEBRAKE 

BACKUP 

PRI FAIL RESET 

MAW CAUTION (flashing) 

Redundancy management - 

The commands are faded gently through a 4-sec time constant 
first-order filter when a static primary system transfers to backup. 
However, transfers will be abrupt if the primary system is in rapid 
motion prior to the downmode. For any downmode the leading edge 
flaps are braked in their existing position. 

Possible failures/causes - 

(1) Flap command - A1 .5* difference between channel 1 and 2 
commands for any TE surface (inboard, mid, or outboard). This 
could be caused by a TE command input discrete difference. 
Examples would be the following: 

(1) Open ALL TE, IN, MID, OUT SLEW discretes up or down 

(2) Open HALF or FULL flap switch discrete 

(3) Open MAW roll trim discrete. 

(2) Flap ideal model - A5° error between the left or right inboard 
ideal flap position model and the actual position. This could 
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be caused by an open or nonfunctioning inboard LVDT (any one 
of 4). 

(3) Servo differential pressure - Ap > 3600 lb/ft^ of force fight 
across any TE flap surface. This could be caused by a stuck TE 
brake (12 total), blocking valve (12 total), failed Ap 
transducer (12 total), or binding in any TE linkage. 

(4) Output discretes - difference in a common output discrete. 

This could be caused by only one channel declaring a model 
fault for a given roll flap. (A model fault sets the MASTER 
discrete to light the MAW CAUTION annunciator and only one 
MASTER discrete is set.) 

(5) Stick monitor - a 0.8 volt of disagreement for the primary 
stick transducer has been detected. This could be caused by a 
open winding in one of the transducers or a faulty stick 
monitor chip. 

(6) Power supply - The power supplies for each FCEU are dual (one 
generator and one battery per channel). Even if an engine 
failed, the main power bus would get power from the other 
side and no redundancy would be lost. However, a single 
failure in the power supply monitor chip in either box (5 volt, 
±15 volt, or 26 vac) would cause the loss of the primary 
system. 

(7) Hydraulic pressure - low primary or utility hydraulic pressure 
less than 1200 lb/ft 2 or failed hydraulic pressure monitor 
chip. 

(8) Built-in tests - (1 ) ROM memory sum check, (2) cross channel 
data transfer, (3) RAM memory check (at power up only), and 
(4) watchdog timer. These cannot be reset. 

Backup Failures - Do Not Set Brakes 

1 . Annunciation - QC FAIL (backup sensed) 

Redundancy management - 

This failure is declared independently of the primary system, 
however, the QC inputs are identical. 

(a) Flap switch in HALF or FULL - fix the roll gain at 1 00 percent 
and allow full authority for the TE flaps. 

(b) Flap switch in RETRACT - fix the roll gain at 27 percent and 
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set the TE flap limit at 4* down. 

(c) If the QC fail is declared in only one of the backup channels, 
then only that channel will be affected by the QC fail RM logic. 

Possible failures/causes - 

(1 ) AQC probes differ by 1 00 lb/ft 2 . This could be caused by 
unusual airplane manuvering. Failure is resettable if the 
probes agree within 1 00 lb/ft 2 . 

(2) Faulty QC fail monitor chip. A latch could be set due to a noise 
spike. 

2. Annunciation - A and B STATUS 

MAW CAUTION (flashing) 

Redundancy management - 

None. This test is executed only while the system is in the 
primary system. It tests for a command difference between backup 
channels A and B. The failed backup system cannot be determined 
from this test alone; however, once a transfer to backup is made, 
other fault tests would likely cause the brakes to be set in the failed 
channel. 

Possible failures/causes - 

Aliveness monitor comparision - cross backup channel command 
error greater than 0.5 volts between channel A and B. This could be 
caused by an open discrete in the flap switch. For example, if the A 
backup FULL discrete were open when the flap switch was placed in 
the FULL position, this type of error would be declared. If the backup 
system were entered under these conditions, the A flaps would drive 
to 2 # (RETRACT) and the B flaps would stay at 18* (FULL). The 
inboard flaps would be braked at 1 8* because of a model fault. 

3. Annunciation - A and/or B STATUS momentarily flash 

Redundancy management - 

None. (Flaps are in HALF or FULL.) 

Possible failure/causes - 

Roll flap ideal model - A5* error between the mid or outboard roll 


61 


flaps ideal position model and the actual position. The A or B status 
lights will light only during the time the fault is being detected. This 
situation can exist only if the flap switch is in HALF or FULL. The 
most common cause is continued rapid stick cycling. 

4. Annunciation - None on MAW panel. A/C LOW HYDRAULICS 
Redundancy management - 

Bypass valves all opened on failed hydraulic PDU's. All the backup 
flaps are being driven at one end only and by one PDU. All backup 
functions still exist; however, possible slower roll flap rates and 
greater tendency for model faults also exist. 

Possible failure/causes - loss of a hydraulic system or failure of a 
hydraulic pressure transducer. 


Backup Failures - Set A, B, and/or INBD Brakes 

1 . Annunciation- A, B, or INBD STATUS 
Redundancy management - 

Set the brakes for the A, B, and/or INBD flaps, depending on which 
flap set has declared a fault. The unbraked flaps will continue to 
function. When the system is in primary, set the annunciators only. 

Possible failures/causes - 

(1 ) Valve current comparision - test for a disagreement in the 
PDU commands from a given backup channel to a particular 
flap(s). This could be caused by a faulty operational amplifier 
to one of the PDU commands. 

(2) Position limit - one of the TE flaps has exceeded the QC 
position limit. This could be caused by one of the flaps 
exceeding the TE down position limit while the TE flaps were 
being QC limited (fig. 10). 

Also, this error would result if a QC fail occurred and the flap 
switch was positioned from FULL to RETRACT. 

(3) Flap ideal model - A5° error between the ideal roll flap 
position model and the actual position. (This is only for the 


62 



flap switch in the RETRACT position.) This could be caused by 
continued and rapid stick cycling or a nonfunctioning LVDT. 

(4) Stick monitor - A 0.8 volt disagreement has occurred in a 
stick transducer set for either the A or B backup systems. 

This could be caused by an open winding in one of the 
transducers or a failed stick monitor fault. 

(5) Power supply - Each partitioned backup system has a dual 
redundant power supply (one generator and one battery per 
channel). Even if an engine failed, the main power bus would 
get power from the other side and no redundancy would be lost. 
However, a single failure in the power supply monitor chip in 
either box (5 volt, ±15 volt, or 26 vac) would cause the loss of 
the flaps driven by that backup system, including the inboard 
flaps. 
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